bugGNUstep - Bugs: bug #42411, gdomap chroots to /tmp


You are not allowed to post comments on this tracker with your current authentication level.

bug #42411: gdomap chroots to /tmp

Submitted by:  Yavor Doganov <yavor>
Submitted on:  Fri May 23 16:54:06 2014  
Category: Base/FoundationSeverity: 3 - Normal
Item Group: BugStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Fri Jul 25 13:57:06 2014, comment #5:

I'm tentatively closing this as I've added a '-j' option to specify the path to the jail directory; which gives the user of the program control over how it operates.

Richard Frith-Macdonald <CaS>
Project Member
Fri Jul 25 10:29:56 2014, comment #4:

I agree about 1 and 2 not being options.

I don't agree with (3) since if we don't chroot then we have to assume that the executable has access to the whole filesystem ... and a chroot to /tmp can't possibly be less secure than that.

Perhaps though, we could add a command-line argument to specify the directory to which we should chroot, and only use the existing location if that argument is not provided? Then a distro could have a startup script which jails the process in a known-safe location for that distro.

Richard Frith-Macdonald <CaS>
Project Member
Fri Jul 25 10:09:37 2014, comment #3:

The bug submitter suggests:

1) create an empty directory in /run (optionally via tmpfiles.d)

2) or ship one in /usr/share/gdomap/empty-directory-for-chroot (or so) in the package itself

3) Don't chroot? That is less broken than chroot into a
world-writable location.

I believe 1) is not portable while 2) is not acceptable as a general solution since it is distro-specific.

Yavor Doganov <yavor>
Sun Jul 13 11:05:28 2014, comment #2:

I don't know either, I'll ask the original bug submitter.

> is there a debian specific standard for this which
> could be conditionally compliled when building on a
> debian system?

I don't think so. I believe this was not caught by an automatic security-check tool. It's just that some people have a habit to review daemons' code and gdomap seems to be getting a lot of attention :-)

Yavor Doganov <yavor>
Sun Jul 13 07:42:10 2014, comment #1:

I don't mind making things even more paranoid, but I don't know of an empty, non-writable directory that the program can reliably move to, and creating a directory which could then not be cleaned up on program termination (because the program is chrooted inside it) does not seem an acceptable option.
Is there a standard portable way to do this (a quick internet search didn't reveal anything to me)?
Failing that, is there a debian specific standard for this which could be conditionally compliled when building on a debian system?

Richard Frith-Macdonald <CaS>
Project Member
Fri May 23 16:54:06 2014, original submission:

Another report from Debian, original URL:

"gdomap chroots to /tmp "as another level of paranoia". However if you are paranoid, you really want to chroot to an empty, non-writable directory, not to a world-writable one containing random files."

Yavor Doganov <yavor>


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by CaS (Posted a comment)
  • -unavailable- added by yavor (Submitted the item)
  • -unavailable- added by yavor

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri Jul 25 13:57:06 2014CaSStatusNone=>Fixed
    Fri May 23 16:54:06 2014yavorCarbon-Copy-=>Added -unavailable-

    Back to the top

    Powered by Savane 3.1-cleanup1